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EXECUTIVE SUMMARY 


This report documents the findings of an examination of tabulated vote 
databases based on forensic analysis of the drive image of Mesa County, 
Colorado’s Dominion Voting Systems (DVS) Election Management System (EMS) 
server. The findings in this report were prepared by the authors as consultants 
to the legal team representing Tina Peters, the Mesa County Clerk and Recorder, 
pursuant to her statutory duties as Mesa County’s Chief Election Official. The 
findings provide evidence of potentially unauthorized and illegal manipulation of 
tabulated vote data during the 2020 General Election and 2021 Grand Junction 
Municipal Election. Because of this evidence, which led to the vote totals for those 
elections being impossible to verify, the results and integrity of Mesa County’s 
2020 General Election and the 2021 Grand Junction Municipal Election are in 
question. 


This analysis was performed using the forensic image of the EMS server, which 
was backed up before Colorado Secretary of State and DVS overwrote the hard 
drive with D-Suite version 5.13. 


Findings and Implications: 


1) There was an unauthorized creation of new election databases during early 
voting in the 2020 General Election on October 21, 2020, followed by the 
digital reloading of 20,346 ballot records into the new election databases, 
making the original voter intent recorded from the ballots unknown. In 
addition, 5,567 ballots in 58 batches did not have their digital records 
copied to the new database, although the votes from the ballots in those 
batches were recorded in the Main election database. 


2) The same unauthorized creation of new election databases occurred 
during the 2021 Grand Junction Municipal Election on March 30, 2021, 
followed by the digital reloading of 2,974 ballot records, making the 
original voter intent recorded on those ballots unknown. In addition, 
4,458 ballots in 46 batches did not have their digital records copied to the 
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new database, although the votes from the ballots in those batches were 
recorded in the Main election database. 


3) The absence of secure hash algorithm (.sha) files for each digital ballot 
image makes the authenticity of each digital ballot image, and the ballot- 
level record for those ballots, impossible to verify. 


4) The true total vote count in Mesa County, Colorado cannot be accurately 
calculated for the 2020 General Election or the 2021 Grand Junction 
Municipal Election from records in the databases of the county’s voting 
system. 


5) There is no function or feature on the EMS server that could 
be executed inadvertently or deliberately by a local election official that 
would cause this combination of events to occur, especially within the time 
frame that these events occurred. Given the complex sequence of data 
manipulations and deletions necessary to produce the digital evidence 
described in this report, this combination of events could not have been the 
result of either deliberate or inadvertent actions by those officials. 


6) Dominion’s installation of the Trusted Build update on the EMS in May of 
2021, as ordered by the Colorado Secretary of State, destroyed all data on 
the EMS hard drive, including the batch and ballot records that evidenced 
the creation of new databases and reprocessing of ballot records described 
in Findings 1 and 2 above. This destruction of all data by the trusted build 
is described in the “Mesa County, Colorado Voting Systems Forensic 
Examination and Analysis Report”. 


7) The fact that such ballot record manipulation has been shown 
demonstrates a critical security failure with the DVS EMS wherever it is 
used. The manipulation would not be identifiable to an election official 
using the voting systems, nor to an observer or judge overseeing the 
election conduct, much less to citizens with no access to the voting systems; 
without both cyber and database management system expertise, and 
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unfettered access to database records and computer log files (many of 
which were destroyed by the actions of the Secretary of State) from the 
EMS server, the manipulation would be undetectable. 


INTRODUCTION 


The use of computerized election management systems is now nearly universal 
across counties in the United States. While the use of these systems is touted as 
“efficient”, potentially decreasing manpower costs and time to produce election 
results, it also greatly reduces the transparency of the election process and 
exposes our elections to extraordinary vulnerability from both inadvertent and 
deliberate misconfiguration or misuse. Americans’ right to free and fair elections 
is inalienable, but that right is infringed by lack of transparency, and by whatever 
lies behind that opaque curtain. 


Without free and fair elections and the transparency to see it for themselves, 
without relying on the assertions of any other person or organization, Americans’ 
consent and the legitimacy of our government, at all levels, is in doubt. If 
Americans’ votes are to be recorded and counted by machines, every aspect of 
those machines’ operation, configuration, and data must be recorded, 
immediately available at no cost or administrative burden to citizens and their 
independent examiners and confirmed 100% accurate through that independent 
verification. The absence or shortfall of any of those three imperatives (recorded, 
available, and independently verified) should immediately cause the public to 
distrust both the purported result from those machines, and also anyone who 
insists that they accept those results. 


Numerous Federal and State laws attempt to safeguard our voting rights and 
the integrity of our elections. Title 52 USC provides for much of the Federal 
guidance in this area, and Colorado Revised Statute (CRS) Title 1 covers most of 
the Colorado state guidance. 


a) 52 U.S. Code § 10307 prohibits any person acting under color of law to 
“,. willfully fail or refuse to tabulate, count, and report...” the vote of any 
person entitled to vote. 
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52 U.S. Code § 10308(a) prescribes penalties for any person depriving or 
attempting to deprive any person of voting rights under Federal statute. 
52 U.S. Code § 10308(c) prescribes penalties for conspiring to violate or 
interfere with secured voting rights. 

52 U.S. Code § 20701 mandates the preservation of all election records for 
22 months after an election for Federal offices.1 

52 U.S. Code § 20702 prescribes penalties for theft, destruction, 
concealment, mutilation, or alteration of § 20701 election records. 

52 U.S. Code § 21081 requires that voting systems used in elections for 
Federal office meet the standards of that section, including that the voting 
system shall produce a record with an audit capacity for such system, and 
that “the error rate of the voting system in counting ballots...shall comply 
with the error rate standards established under section 3.2.1 of...” the 
Federal Election Commission 2002 Voting System Standards (VSS).3 

CRS §1-5-601.5 requires that voting systems and equipment in Colorado 
meet 2002 VSS standards, at minimum. 

CRS §1-7-802 requires the preservation of election records for 25 months 
after elections. 

CRS §1-13-111 prescribes penalties for destroying, removing, or delaying 
delivery of election records. 


Title 52 clarifies that the “every officer of election” is responsible for maintaining 


the election records. 


! U.S. Department of Justice Publication “Federal Law Constraints on Post-Election ‘Audits’,” July 28, 2021, states that “The 
materials covered by Section 301 extend beyond ‘papers’ to include other ‘records.’ Jurisdictions must therefore also retain and 
preserve records created in digital or electronic form.” 


2 The Federal Election Commission’s 2002 Voting System Standards, the standards of which are mandatory minima for certification 
of voting systems under Colorado state statute $ 1-5-601.5., specifies that a voting system which “...provides access to incomplete 


election returns and interactive inquiries before the completion of the official count...shall: a. ...be designed to provide external 


access to incomplete election returns only if that access for these purposes is authorized by the statutes and regulations of the using 
agency...b. Use voting system software and its security environment designed such that data accessible to interactive queries resides 
in an external file, or database, that is created and maintained by the elections software under the restrictions applying to any other 
output report, namely, that: 1) The output file or database has no provision for write-access back to the system. 2) Persons whose only 
authorized access is to the file or database are denied write-access, both to the file or database, and to the system,” and states that the 
Standards are “intended to address...risks to the integrity of a voting system...,” including “...Changing calculated vote totals;...” and 


“Preventing access to vote data, including individual votes and vote totals, to unauthorized individuals;...” 
3 2002 VSS, para 3.2.1 specifies “d. For central-county systems...: Consolidation of vote selection data from multiple counting 


devices to generate jurisdiction-wide vote counts, including storage and reporting of the consolidated vote data...a target error rate of 
no more than one in 10,000,000 ballot positions.” A ballot position is each and every choice (e.g. a “bubble” which can be marked or 


filled-in) on a ballot selectable by a voter to convey their voting choices. 
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Mesa County, Colorado, uses software and hardware provided by DVS and for the 
2020 General Election and the 2021 Grand Junction Municipal Election, 
specifically used “D-Suite 5.11-CO.” The primary voting system EMS server, which 
contains the raw tabulated vote information used to produce official election 
reports, makes use of Microsoft SQL Server 2016 databases running on the 
Microsoft Windows Server 2016 operating system. The forensic image used for 
the analysis, created on May 23, 2021, has been validated as authentic. 


DEFINITION OF TERMS 


“Ballot”: Mesa County used two-sided paper ballots in the November 2020 
General Election and the 2021 Grand Junction Municipal Election. A ballot is a 
device used to cast votes in an election. In Colorado, ballots are pieces of paper 
defining races and issues, and reflecting the choices of individual voters from 
among the options available for each race and issue. A digital image of each 
paper ballot is created by the DVS D-Suite voting system during the processing 
of ballots, as described below, and that ballot image is stored on the designated 
“NAS (Network Attached Storage device)” of the D-Suite voting system. 


“Adjudication”: A term used to describe the process of determining voter intent 
from а voter’s ballot marks, where ballot markings are ambiguous. According to 
Dominion’s Democracy Suite Use Procedure Manual, adjudication is “the process 
of examining voted ballots to determine, and, in the judicial sense, adjudicate 
voter intent”. In the DVS D-Suite, adjudication refers to the operation and use of 
a software component called “EMS Adjudication,” and the process of using that 
software component to manually or automatically interpret voter intent from 
scanned ballot images, and then to record that interpretation as the record of 
the vote choices for the affected ballots, in both “result files” and ballot images. 
Depending on software configuration choices, individual ballot images/result 
files, entire batches of ballot images/result files, or all ballot images/result files 
can be subjected to automatic or manual adjudication on the basis of 
“exceptions” or “outstack conditions” (e.g., “overvotes”, where too many choices 
are marked for a race or issue; or “marginal marks” when ballot choice ovals are 
not adequately filled in), or by the arbitrary decision of EMS administrators. 
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“Manual Adjudication”: Either all ballot images, or individual ballot images, or 
those from particular batches or tabulators, in which voter intent for any race or 
issue is flagged by the EMS Adjudication software module as not being 
determinable (or as having “exceptions”), are, in theory, sent to “Manual 
Adjudication” stations where officials called “Adjudicators” view the digital 
images of the ballots and decide the voter’s intent. In this Report we sometimes 
use the terms “manual adjudication” and “machine adjudication” to clearly 
distinguish the process of human judging of voter intent from the process of the 
DVS EMS Adjudication software’s determining of voter intent. 


“Adjudication database”: The DVS D-Suite version used in Mesa County during 
the November 2020 and April 2021 elections maintains a separate SQL Server 
database, called an “AdjudicableBallotStore,” created by DVS software, for each 
election which contains records of all batches and ballots scanned into the voting 
system through ImageCast scanning workstations, and any batch and ballot 
records manually entered. The database maintains critical information about 
each batch and ballot, most importantly the ballot Adjudication status and the 
file location of the ballot image. A batch can have any of the following 
adjudication statuses in the adjudication system: In-Progress, Read Error, 
Review, Pending Submission, Submitted, or Submission Error.* Throughout, 
“Adjudication database." 


“Main election database”: The DVS D-Suite version used in Mesa County during 
the November 2020 and April 2021 elections maintains a database for each 
election, called an “ElectionStore” by DVS, which contains information defining 
an election, including contest, candidate, and ballot definitions as well as 
aggregated vote information which is used to produce all election reports 
generated by County officials. Throughout, “Main database.” 


“Tabulation database”: The DVS D-Suite version used in Mesa County during the 
November 2020 and April 2021 elections maintains a database for each election, 


4 In-Progress batches have been acquired by the system (e.g. through scanning at an ICC) and have ballots being served to clients 
(Adjudication); Read Error batches are those which encounter errors while being loaded into the system; Review are batches with all 
ballot adjudication complete, including batches with no adjudication required; Pending Submission are batches submitted to tally, but 
which have not yet completed that transmission to the tally process; Submitted are batches which have completed the transmission to 
the tally process; Submission Error are batches that were submitted to the tally process, but which were unsuccessfully submitted. 
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called a “TabulationStore” by DVS, which contains the timestamps and ballot 
counts for each batch of ballots, which duplicates that information contained in 
the Adjudication database. It contains other tables which are not used by Mesa 
County’s elections. Throughout, “Tabulation database.” 


“Reprocessed”: For the purposes of this Report, the term “reprocessed” means 
that one or more data records which had already been created, presumably by 
scanning of paper ballots through an ImageCast Central (ICC) workstation, 
though also technically possible through manual entry of records, within the 
databases associated with an election, were loaded into the system again toa 
different database, and that this re-loading was not performed in connection 
within any documented, authorized election-related operations procedure or 
function. A comparison with the log files of the respective ICC workstations might 
reveal whether the reprocessed paper ballots were, in fact, rescanned at the ICC, 
but many of those log files have been destroyed by the Secretary of State’s 
“Trusted Build.” 


ANALYSIS 


I. Evidence of ballot record data manipulation - November 2020 General 
Election 


Our analysis shows manipulation, which was neither initiated nor authorized by 
Mesa County election clerks, of the batches and ballots processed during the 
first three days of ballot processing in the November 2020 General Election. 


The following timeline of events, beginning October 19, 2020, when Mesa County 
began processing ballots in the General Election, demonstrates this 


manipulation of ballots. 


October 19, 2020 - October 21, 2020, 2:14 PM 


On these first three days of ballot counting in Mesa County, up until 2:14 PM on 
October 21, 2020, 267 batches, consisting of 25,913 ballots, were physically 
processed (physically scanned on DVS ICC scanners with voters’ choices, in the 
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form of marks on the ballots, scanned and interpreted by software) through 
three tabulators, internally identified in the Main database as tabulator IDs 4, 7, 
and 10. Mesa County election clerks reported no unusual activity or errors 
encountered during the processing of these 267 batches. The Adjudication 
database used at this time contains records of all batches with a sequential “load 
order” of 1 to 267, and other tables within it record the information about each 
ballot, for instance the time it was entered into the database, the tabulator used, 
and the adjudication status. Those which were selected for Adjudication have the 
proper status records indicating that the normal adjudication steps occurred. 


The initial 10 batches processed through tabulator 10, containing a total of 941 
ballots, had timestamps indicating that they were all entered into the database 
within 47 seconds (total - not 47 seconds per batch, but 47 seconds for 10 
batches). (See Appendix A for a list of the batches and their timestamps in the 
original Adjudication database.) The Canon DR-G1130, which according to 
purchasing documents and Colorado Secretary of State voting equipment 
inventories is the model of scanners used by Mesa County (See Reference C and 
the Colorado Secretary of State website”), operates at approximately 100 pages 
per minute (ppm), duplex, meaning that scanning both sides of each ballot would 
take no less than 0.01 minutes, which is 0.6 seconds, per ballot. 941 ballots at 
0.6 seconds per ballot should have taken a minimum of 564 seconds, or slightly 
under 9 and a half minutes, a significantly longer interval than 47 seconds, which 
is physically impossible. Mesa County election clerks were unaware of these 
batch timestamps, or any issue which could explain them. 


October 21, 2020 - 2:14 PM 


According to the data contained in the EMS SQL Server Database, new Tabulation 
and Adjudication databases were created on the EMS server at 12:18:50 PM 
October 01, 2020. These databases initially contained no data records. 


5 CO SecState Voting Equipment Inventory at: https://archive.ph/RQS91 
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Figure 1. "Before" Screenshot of Databases on the Mesa EMS Server 


name 
1 2020 Mesa County General-2020-09-05-00-10-20 


2 AdjudicableBallotStore 2020 Mesa County General 
3 TabulationStore 2020 Mesa County General 


One Adjudication database and one Tabulation database were listed, with 
creation times before the counting in Mesa County began on October 19, 2020. 


Figure 2. "After" Screenshot of Databases on Mesa EMS Server 


name 
2020 Mesa County General-2020-09-05-00-10-20 


AdjudicableBallotStore_2020 Mesa_County_General 
TabulationStore_2020 Mesa_County_General 
AdjudicableBallotStore 2020 Mesa County General 2020-1 _ 12:18:50 


TabulationStore_2020 Mesa_County_General_2020-10-01_ 12:18:50 


ar WH m 


Two Adjudication databases (“AdjudicableBallotStore”) and two Tabulation 
databases (“TabulationStore”) are now listed, one set of which had creation times 
before the date and time ballot scanning and tabulation began in Mesa County 
on October 19, 2020 and the other set of which the EMS server data indicate 
were created two and a half days after ballot scanning and tabulation began. 


It has been observed that a clerk giving the EMS system a command to stop and 
then restart adjudication in an election again creates new Adjudication and 
Tabulation databases. Mesa County clerks are very certain that they did not 
initiate any such action in either the November 2020 or the April 2021 elections. 
Therefore, it is likely that a procedure internal to the DVS software had to 
perform a stop and restart of the adjudication services in order to perform the 
batch and ballot manipulation which occurred later (see below). 


There are only a few possibilities which would explain how the database copying 
process was initiated. 
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1. Direct action by Mesa County personnel 
The client application used by election clerks does give them the ability to 
stop and restart adjudication, which would create the new databases. 


However, Mesa County personnel are very clear that they did nothing of the 
sort and explained that they would only do such a thing in an extreme 
emergency, as the process would have made the production of legally 
mandated reports very difficult. 


2. Triggered remotely 
“Report #2, Forensic Examination and Analysis Report” by D. Gould 
identifies numerous security vulnerabilities in the DVS EMS server. A 
signal, or external trigger,” giving instructions to software inside the EMS 
server could have been sent to and received through any of the open 
communication ports, or through the port 80 Web Server port, which has 
been demonstrated to be open on the server and accepting commands via 
an application programming interface (API).’ This signal, along with other 
information, could have been received via a local network connection 
(from any device connected to the EMS server's internal network), from a 
remote network connection (if the EMS server’s internal network has been 
bridged to the external internet), or via an internal cellular modem 
installed in the EMS server. If the EMS Server was connected to a wireless 
network, it is feasible that even a cell phone outside of the building, but 
still within the wireless signal radius, could have been used to trigger the 
events. 


This option is plausible but infers a degree of external, time-sensitive 
control over the DVS equipment in use in Mesa County. This control might 


6 E.g., an “external trigger” most people are familiar with is the function whereby their smartphone’s wi-fi connection is turned on in 
response to detecting the proximity of a saved, pre-approved wi-fi network. The external trigger satisfies the criteria of an internal, 
saved rule for application behavior, and the application then executes the correlated command or function. We likely don’t think of 
“Do Not Disturb” mode on our smartphones as being similarly controlled by an external trigger, but if our smartphones are configured 
to “use network time,” meaning the time signal transmitted by the cellular carrier network, then our smartphones’ “Do Not Disturb” 
mode isn’t turned on at the time we set, per se, but when our cellular carrier tells our phone that the specified time is reached. 

7 An API is a specification for interaction which allows computer applications to communicate with, make requests to, and issue 
commands to other computer applications. I.e., API enables machine-machine communication, coordination, and command and 
control, depending on the permissions and allowable exchanges of the specific API specification. 
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be considered undesirable by the perpetrators responsible for 
manipulating the election data, because it was a possibility that any 
unauthorized network connections, whether they be via standard ethernet, 
wireless network connection, or cellular modem, could have been 
discovered during the election period. 


3. Algorithmically Triggered 
A software algorithm® running inside the DVS computer systems in Mesa 
County could have made the decision to perform the new database 
creations and the selected record manipulation which followed based on 
preprogrammed criteria related to the election results at the time. 


Given that this method requires the least amount of external control and 
monitoring, this option would seem to be the most likely. The decision to 
copy the Adjudication and Tabulation databases and re-process the ballot 
records would be made by software running inside the Dominion EMS (or 
inside another connected machine running Dominion software) based on 
unexpected voting patterns. 


October 21, 2020, 2:30 PM - 2:34 PM 


During this time period, 209 out of the original 267 batches (containing a total 
of 20,346 ballots) were digitally - not physically - loaded into the new 
Adjudication and Tabulation databases. Specifically, records for batches with 
load order 2 through 59 were not reloaded and do not appear in the new 
Adjudication database in any form. The timestamps of the 209 batch records 
(load order 1 and load orders 60 through 267) show an impossibly short 
processing time (approximately 4 seconds each) for these batches to have been 
physically processed into the newly created Adjudication and Tabulation 
databases. As described above, because of the minimum scanning time of one 


8 An “algorithm” is simply a set of rules for logical, sequential consideration of inputs (e.g. a contingent variable state, like “the switch 
is off’ or “the switch is on,” or the value of field/memory location “X” is “1” or is “Not 1”) to produce a consistent, expected output. 
In this case, a simple, hypothetical algorithm might have been something like “IF (‘numberofbatches’>50) AND 
(“ElectionProjectActive’=TRUE) AND (“EMSAdminUserLoggedIn”=FALSE) AND 
(VOTETOTAL,“InternalMachineID:01”>VOTETOTAL, “InternalMachineID:02”) AND (SYSTIME>20201019) AND 
(SYSTIME<20201103) THEN COPY:BATCHID030010:BATCHID030059 AND INSERTINTO “adjudicableballotstore,” etc. 
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minute per batch for the Canon DR-G1130 scanner-based tabulator, it is not 
possible for these 20,346 ballots to have been physically rescanned (i.e., the 
paper ballots were not reloaded into the scanning hardware), but rather the 
digital batch and ballot records were directly added to the new Adjudication 
database. This indicates that the batches could only have been loaded into the 
newly created Adjudication and Tabulation databases by using software code or 
a script running within the EMS server. See Appendix B for a list of all batches 
and their timestamps in the new Adjudication database. See Appendix C for a list 
of all commands executed prior to and after the database copy, which provides 
a precise timeline of the effects of those commands on the database copy. 


It is important to note that this unauthorized procedure only copied the records 
of selected batches of ballots, indicating that this was an intentional act. 


Below is a screenshot of the beginning of the list of batches recorded in the 
original Adjudication database, sorted by the order that they were loaded: 


Figure 3. List of Batches Recorded in the Original Adjudication Database, Sorted by Load Order 


а Batchld Category CvrBatchld Name LoadOrder CreationTime ModificationTime 


1 4001 о 1 Tabulator 10 - Batch 4001 1 2020-10-19 12:07:40.850 2020-10-19 12:09:58.200 
2 7 4002 0 2 Tabulator 10 - Batch 4002 2 2020-10-19 12:07:44.443 2020-10-20 10:43:25.547 
3 4003 о 3 Tabulator 10 - Batch 4003 З 2020-10-19 12:07:48.257 2020-10-20 10:43:26.437 
4 4004 0 n Tabulator 10 - Batch 4004 4 2020-10-19 12:07:50.960 2020-10-20 10:43:27.423 
5 4005 0 5 Tabulator 10 - Batch 4005 5 2020-10-19 12:07:53.960 2020-10-20 10:43:28.500 
6 4006 о 6 Tabulator 10 - Batch 4006 6 2020-10-19 12:08:12.123 2020-10-20 10:43:29.907 
7 4007 0 7 Tabulator 10 - Batch 4007 7 2020-10-19 12:08:16.137 2020-10-20 10:43:30.953 
8 4008 о 8 Tabulator 10 - Batch 4008 8 2020-10-19 12:08:20.107 2020-10-20 10:43:32.390 
9 4009 о 9 Tabulator 10 - Batch 4009 9 2020-10-19 12:08:24.170 2020-10-20 10:43:33.673 
10 10 4010 0 10 Tabulator 10 - Batch 4010 10 2020-10-19 12:08:28.233 2020-10-20 10:43:34.703 
1 4 2001 0 11 Tabulator 4 - Batch 2001 11 2020-10-19 12:23:35.457 2020-10-20 10:42:50.047 
12 4 2002 о 12 Tabulator 4 - Batch 2002 12 2020-10-19 12:30:25.763 2020-10-20 10:42:51.343 
13 4 2003 о 13 Tabulator 4 - Batch 2003 13 2020-10-19 12:32:30.137 2020-10-20 10:42:52.470 
14 4 2004 о 14 Tabulator 4 - Batch 2004 14 2020-10-19 12:36:19.937 2020-10-20 10:42:52.970 
15 4 2005 0 15 Tabulator 4 - Batch 2005 15 2020-10-19 12:43:25.387 2020-10-20 10:42:53.797 
16 4 2006 0 16 Tabulator 4 - Batch 2006 16 2020-10-19 13:50:28.623 2020-10-20 10:42:48.593 
17 4 2007 0 17 Tabulator 4 - Batch 2007 17 2020-10-19 13:54:18.990 2020-10-20 10:42:54.533 
18 4 2008 о 18 Tabulator 4 - Batch 2008 18 2020-10-19 13:58:23.777 2020-10-20 10:42:56.080 
19 4 2009 0 19 Tabulator 4 - Batch 2009 19 2020-10-19 14:03:28.847 2020-10-20 10:42:57.673 
20 4 2010 0 20 Tabulator 4 - Batch 2010 20 2020-10-19 14:06:33.427 2020-10-20 10:42:58.877 
21 4 201 0 21 Tabulator 4 - Batch 2011 21 2020-10-19 14:10:23.157 2020-10-20 10:42:59.563 
22 4 2012 0 22 Tabulator 4 - Batch 2012 22 2020-10-19 14:14:28.253 2020-10-20 10:43:00.360 
23 4 2013 0 23 Tabulator 4 - Batch 2013 23 2020-10-19 14:18:33.053 2020-10-20 10:43:00.970 
24 4 2014 0 24 Tabulator 4 - Batch 2014 24 2020-10-19 14:22:22.753 2020-10-20 10:43:01.533 


Note that there is a sequential order with all load order numbers represented. 
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Below is a screenshot of the same table in the newly created Adjudication 
database: 


Figure 4. List of Batches in Newly Created Adjudication database 


LoadOrder CreationTime ModificationTime 


Tabulatorld Batchld Category CvrBatchld Name 


1 10 4001 0 1 Tabulator 10 - Batch 4001 1 2020-10-21 14:20:07.257 2020-10-22 10:33:50.593 
2 10 4025 0 60 Tabulator 10 - Batch 4025 60 2020-10-21 14:20:26.273 2020-10-22 10:33:51.907 
3 4 2036 0 61 Tabulator 4 - Batch 2036 61 2020-10-21 14:20:30.477 2020-10-22 10:31:56.047 
4 10 4026 0 62 Tabulator 10 - Batch 4026 62 2020-10-21 14:20:34.430 2020-10-22 10:33:53.330 
5 4 2037 0 63 Tabulator 4 - Batch 2037 63 2020-10-21 14:20:39.043 2020-10-22 10:31:56.780 
6 10 4027 0 64 Tabulator 10 - Batch 4027 64 2020-10-21 14:20:43.107 2020-10-22 10:33:54.423 
7 10 4028 0 65 Tabulator 10 - Batch 4028 65 2020-10-21 14:20:47.370 2020-10-22 10:33:55.703 
8 4 2038 0 66 Tabulator 4 - Batch 2038 66 2020-10-21 14:20:51.527 2020-10-22 10:31:57.297 
9 4 2039 0 67 Tabulator 4 - Batch 2039 67 2020-10-21 14:20:55.887 2020-10-22 10:31:58.187 
10 4 2040 0 68 Tabulator 4 - Batch 2040 68 2020-10-21 14:21:00.060 2020-10-22 10:31:58.860 
11 4 2041 0 69 Tabulator 4 - Batch 2041 69 2020-10-21 14:21:04.060 2020-10-22 10:31:59.907 
12 10 4029 0 70 Tabulator 10 - Batch 4029 70 2020-10-21 14:21:08.260 2020-10-22 10:33:56.843 
13 4 2042 0 71 Tabulator 4 - Batch 2042 71 2020-10-21 14:21:12.747 2020-10-22 10:32:00.593 
14 10 4030 0 72 Tabulator 10 - Batch 4030 72 2020-10-21 14:21:16.810 2020-10-22 10:33:57.640 
15 4 2043 0 73 Tabulator 4 - Batch 2043 73 2020-10-21 14:21:20.747 2020-10-22 10:32:01.217 


While the record of the batch with load order 1 was copied, there is a gap of 58 
batches before the second line, which is a record of the batch with load order 
60. Batch load order numbers 2 through 59 were not copied, effectively deleting 
them in the new Adjudication database. 


The data records describing the batches and the ballots contained within them 
in the new Adjudication database, specifically the time stamps shown in 
Appendix B as well as statements by Mesa County election officials, indicate that 
the paper ballots and batches were not physically re-scanned. Therefore, it 
appears the process of scanning these ballots was simulated, and the records of 
the batches and the ballots contained within them were electronically 
transferred from the original Adjudication database into the new Adjudication 
database. 


For example, below is the sequence of events detailing the processing of batch 
4024 (whose ballots and records were not copied to the new Adjudication 
database) and batch 4025 (whose ballots and records were copied to the new 
Adjudication database). This will illustrate the contrast between copied and 
uncopied batch and ballot records. 
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Batch 4024 is recorded in the original Adjudication database as being created 
at 4:09:34 PM on October 19. It contained 100 ballots and was scanned by 
tabulator 10. Ten of these ballots from batch 4024 were subsequently 
manually adjudicated. The manually adjudicated ballot numbers in the batch 
which were manually adjudicated were 4, 8, 13, 14, 30, 48, 63, 87, 88, and 90. 
Then, the votes contained on all 100 ballots were recorded in the appropriate 
tables in the Main database (see Reference A for a list of these tables). When 
the new Adjudication database was created, no records from Batch 4024 were 
copied to it, and thus there was no reprocessing or physical rescanning of the 
ballots. Adjudication history for the 10 ballots which were manually 
adjudicated was no longer available to the Mesa County clerks, and the original 
voter intent of these ballots is unknown. 


In contrast, Batch 4025 is recorded in the original Adjudication database as 
being processed at 4:12:23 PM on October 19. This batch contained 99 ballots 
and was also scanned by tabulator 10. Fourteen of these ballots were 
subsequently manually adjudicated. The ballot numbers in the batch which 
were manually adjudicated were 3, 10, 13, 21, 22, 23, 34, 40, 49, 59, 66, 79, 
97, and 99. Then, the votes contained on all 99 ballots were recorded in the 
appropriate tables in the Main database. 


After the new Adjudication database was created, a record of Batch 4025 
appeared in its tables at 2:20:26 PM on October 21. It is still listed as having 
99 ballots and from tabulator 10. In the new Adjudication database, however, 
only 6 of the batch 4025 ballots (8 less than the first time these batches were 
entered into the original Adjudication database), were again manually 
adjudicated. The individual ballot numbers were 3, 21, 22, 40, 59, and 66. At 
this point, the vote records from at least those 6 ballots and possibly all 99 
would have been recorded in the appropriate tables in the Main database, 
replacing the votes which were already in that database from those ballots. 
Adjudication history for the 14 ballots which were manually adjudicated was 
no longer available to the Mesa County clerks, and the original voter intent of 
these ballots is unknown. 
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The selected batches in the new Adjudication database (batch 1 and batches 60 
through 267) appeared in the same serial order that they were loaded into the 
original Adjudication database, with the same batch numbers, ballot counts, and 
load order numbers (compare Appendix A and Appendix B). 


October 21, 2020, shortly after 2:34 PM 


At this point, as reported by Mesa County election officials, some Mesa County 
adjudication officials began noticing that they were being asked to look at ballots 
that they had already adjudicated. This is consistent with these ballots and 
batches being reprocessed in the new Adjudication database. When the new 
Adjudication database was created, and the selected records described above 
were copied and reprocessed, there were outstanding ballots from the last set 
of batches scanned before the event. As some of these ballots were sent to 
manual adjudication again after the batches were reprocessed, this caused a 
situation where the same ballot was in the manual adjudication process twice. 
This caused confusion among the election staff who were assigned the duty of 
manual adjudication, since when a ballot was adjudicated the second time the 
master count of adjudicated ballots, which is displayed by the Dominion system 
and is used by the election clerks to track the overall adjudication process, did 
not change. This caused the Adjudication officials to assume that there had been 
an error and, in some cases, to attempt additional manual adjudications of the 
same ballot with the same unsatisfactory result. 


According to several Mesa County election officials, DVS support was contacted 
at approximately 4PM on the 21% of October, and while the support 
representative claimed to not have a solution for the issue Mesa County was 
seeing, that issue ceased soon afterwards. This indicates that DVS may have 
performed or caused to be performed an operation unknown to Mesa County 
election officials (and outside of their control) to address this problem which 
manifested after the unauthorized database manipulation. 
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Of the 209 batches which were processed twice (batches 1 and 60 through 267), 
the ballot counts match between the old and new Adjudication database. 
However, DVS software marked 2,166 ballots for manual adjudication the first 
time they were processed in the original Adjudication database, but when 
reprocessed in the new Adjudication database the software marked only 965 
ballots for manual adjudication. 


The same ballots run through the same hardware and evaluated by the same 
software should have had the same resulting ballots marked for adjudication, 
but they did not. This leads to the logical critical conclusion that not all the 
ballots in the batches processed after the database copy were the same and had 
the same votes as the ballots in the same batches processed before the database 
copy. There is no record remaining of the votes originally recorded from the 
ballots, and therefore there can be no certainty that the votes now recorded are 
the same. In essence, the chain of custody has been broken for these votes in 
the database. 


The 58 batches which were not duplicated in the new Adjudication database 
must also be seen as suspect, as their chain of custody has also been broken via 
the fact that no record of them or their adjudication exists in the Adjudication 
database in use at the end of the election. A clerk wishing to view the 
adjudication status of a ballot in any of the 58 batches would be unable to do 
SO, aS no information about those batches exists in the new Adjudication 
database. 


Thus, all 25,931 ballot records processed before 2:14 PM on October 21, 2020, 


comprising over 25% of the County’s total over the entire election, cannot be 
verified and should not have been counted. 
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II. Evidence of Ballot Manipulation - April 2021 Grand Junction Municipal 
Election 


Our analysis shows a nearly identical manipulation of the batches and ballots 
processed during the first six days of ballot processing in the April 2021 
Municipal Election in Grand Junction, Colorado. 


The timeline of events beginning March 24, 2021, when Mesa County Election 
clerks began processing ballots in the 2021 Grand Junction Municipal Election, 


follows. 


March 24, 2021 - March 30, 2021, 2:43 PM 


On these first seven days of counting, up until 2:43 PM on March 30, 2021, 88 
batches of ballots, consisting of 8,540 ballots, were processed. County Election 
clerks report no unusual activity or errors encountered at any time during the 
election counting process. The Adjudication database used at this time contains 
records of all batches with a sequential load order of 1 to 88, and other tables 
within it record each ballot. Those which were selected for Manual Adjudication 
(339 in total) have the proper status records indicating the normal adjudication 
steps occurred. 


March 30, 2021, 2:58 PM 


According to the data contained in the EMS server, new Adjudication and 
Tabulation databases were created and registered within the DVS system as the 
associated databases for the election. As in the circumstance previously 
described in the early voting period for the November 2020 election, these two 
databases initially contained no data. 


See Appendix D for a list of all commands executed prior to and after the 
database creation in the April 2021 Municipal Election, which provides a precise 
timeline of the effects of creating the new databases and copying the batch and 
ballot records. 
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It is important to note that this unauthorized procedure copied the records of 
only selected batches of ballots, indicating that this was an intentional act. 


Below is a screenshot of the beginning of the list of batches recorded in the 
original Adjudication database, sorted by the order that they were loaded: 


Figure 5. List of Batches Recorded in the Original Adjudication Database, Sorted by Load Order 


Tabulatorid Batchld Category CvrBatchld Name LoadOrder CreationTime ModificationTime 

30 3000 0 2 Tabulator 30 - Batch 3000 1 2021-03-24 14:52:58.350 2021-03-29 14:07:57.213 
30 3001 0 3 Tabulator 30 - Batch 3001 2 2021-03-24 15:09:05.203 2021-03-29 14:07:57.557 
30 3002 0 4 Tabulator 30 - Batch 3002 З 2021-03-24 15:10:53.607 2021-03-29 14:07:57.917 
30 3003 0 5 Tabulator 30 - Batch 3003 4 2021-03-24 15:13:57.637 2021-03-29 14:07:58.307 
30 3004 0 6 Tabulator 30 - Batch 3004 5 2021-03-24 15:17:01.500 2021-03-29 14:07:58.587 
30 3005 0 Fi Tabulator 30 - Batch 3005 6 2021-03-24 15:21:03.903 2021-03-29 14:07:58.837 
30 3006 0 8 Tabulator 30 - Batch 3006 7 2021-03-24 15:24:05.780 2021-03-29 14:07:56.837 
30 3007 0 9 Tabulator 30 - Batch 3007 2021-03-24 15:28:55.220 2021-03-29 14:07:59.273 
30 3008 0 10 Tabulator 30 - Batch 3008 ~ ` 2021-03-24 15:33:59.600 2021-03-29 14:07:59.650 
30 3009 0 11 Tabulator 30 - Batch 3009 10 2021-03-24 15:37:03.750 2021-03-29 14:08:00.010 
30 3010 0 12 Tabulator 30 - Batch 3010 11 2021-03-29 11:06:24.310 2021-03-29 14:08:00.323 
30 3011 0 13 Tabulator 30 - Batch 3011 12 2021-03-29 11:38:04.150 2021-03-29 14:08:00.667 
30 3012 0 14 Tabulator 30 - Batch 3012 13 2021-03-29 11:42:52.697 2021-03-29 14:08:01.040 
30 3013 0 15 Tabulator 30 - Batch 3013 14 2021-03-29 11:45:56.630 2021-03-29 14:08:01.383 
30 3014 0 16 Tabulator 30 - Batch 3014 15 2021-03-29 11:48:00.360 2021-03-29 14:08:01.713 
30 3015 0 17 Tabulator 30 - Batch 3015 16 2021-03-29 11:51:03.987 2021-03-29 14:08:02.040 
30 3016 0 18 Tabulator 30 - Batch 3016 17 2021-03-29 13:05:52.907 2021-03-29 14:08:02.400 
30 3017 0 19 Tabulator 30 - Batch 3017 18 2021-03-29 13:08:56.587 2021-03-29 14:08:02.743 
30 3018 0 20 Tabulator 30 - Batch 3018 19 2021-03-29 13:12:00.483 2021-03-29 14:08:03.073 
30 3019 0 21 Tabulator 30 - Batch 3019 20 2021-03-29 13:14:04.207 2021-03-29 14:08:03.400 
30 3020 0 22 Tabulator 30 - Batch 3020 21 2021-03-29 13:19:53.690 2021-03-29 14:08:03.727 
30 3021 0 23 Tabulator 30 - Batch 3021 22 2021-03-29 13:22:57.557 2021-03-29 14:08:04.103 
30 3022 0 24 Tabulator 30 - Batch 3022 23 2021-03-29 13:26:01.097 2021-03-29 14:08:04.430 
30 3023 0 25 Tabulator 30 - Batch 3023 24 2021-03-29 13:28:04.527 2021-03-29 14:08:04.790 
30 3024 0 26 Tabulator 30 - Batch 3024 25 2021-03-29 13:30:53.410 2021-03-29 14:08:05.133 
30 3025 0 27 Tabulator 30 - Batch 3025 26 2021-03-29 13:32:57.050 2021-03-29 14:08:05.540 
30 3026 0 28 Tabulator 30 - Batch 3026 27 2021-03-29 13:37:01.250 2021-03-29 14:08:05.900 
30 3027 0 29 Tabulator 30 - Batch 3027 28 2021-03-29 13:40:05.090 2021-03-29 14:08:06.227 
30 3028 0 30 Tabulator 30 - Batch 3028 29 2021-03-29 13:41:53.687 2021-03-29 14:08:06.573 
30 3029 0 31 Tabulator 30 - Batch 3029 30 2021-03-29 13:44:57.640 2021-03-29 14:08:06.900 


Below is a screenshot of the same 
database, sorted by creation time: 
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Figure 6. List of Batches in the Newly Created Adjudication Database, Sorted by Creation Time 


‘Tabulatorid Batchid 


Category CvrBatchld Name 


LoadOrder CreationTime 


ModificationTime 


30 | 3047 0 49 Tabulator 30 - Batch 3047 48 2021-03-30 15:00:14.560 2021-03-30 15:25:33.373 
30 ~ 3048 0 50 Tabulator 30 - Batch 3048 49 2021-03-30 15:00:17.950 2021-03-30 15:25:34.090 
30 3050 0 52 Tabulator 30 - Batch 3050 51 2021-03-30 15:00:36.577 2021-03-30 15:25:33.733 
30 3054 0 56 Tabulator 30 - Batch 3054 55 2021-03-30 15:00:50.780 2021-03-30 15:03:21.940 
20 2000 0 59 Tabulator 20 - Batch 2000 58 2021-03-30 15:01:01.250 2021-03-30 15:03:19.520 
20 2002 0 61 Tabulator 20 - Batch 2002 60 2021-03-30 15:01:07.983 2021-03-30 15:03:19.847 
20 2003 0 62 Tabulator 20 - Batch 2003 61 2021-03-30 15:01:11.467 2021-03-30 15:03:20.050 
20 2004 0 63 Tabulator 20 - Batch 2004 62 2021-03-30 15:01:15.123 2021-03-30 15:03:19.127 
20 2005 0 64 Tabulator 20 - Batch 2005 63 2021-03-30 15:01:18.687 2021-03-30 15:03:20.237 
20 2006 0 65 Tabulator 20 - Batch 2006 64 2021-03-30 15:01:22.203 2021-03-30 15:03:20.410 
20 2008 0 67 Tabulator 20 - Batch 2008 66 2021-03-30 15:01:29.203 2021-03-30 15:03:20.627 
20 2009 0 68 Tabulator 20 - Batch 2009 67 2021-03-30 15:01:32.953 2021-03-30 15:03:20.847 
20 2010 0 69 Tabulator 20 - Batch 2010 68 2021-03-30 15:01:36.467 2021-03-30 15:03:21.033 
20 2011 0 70 Tabulator 20 - Batch 2011 69 2021-03-30 15:01:40.437 2021-03-30 15:03:21.237 
20 2012 0 71 Tabulator 20 - Batch 2012 70 2021-03-30 15:01:44.513 2021-03-30 15:03:21.410 
20 2013 0 72 Tabulator 20 - Batch 2013 71 2021-03-30 15:01:48.063 2021-03-30 15:03:21.567 
20 2015 0 74 Tabulator 20 - Batch 2015 73 2021-03-30 15:01:55.170 2021-03-30 15:03:21.723 
20 2016 0 75 Tabulator 20 - Batch 2016 74 2021-03-30 15:01:58.827 2021-03-30 15:03:39.753 
20 2018 0 77 Tabulator 20 - Batch 2018 76 2021-03-30 15:02:05.920 2021-03-30 15:03:47.913 
20 2019 0 78 Tabulator 20 - Batch 2019 77 2021-03-30 15:02:09.407 2021-03-30 15:03:48.210 
20 2020 0 79 Tabulator 20 - Batch 2020 78 2021-03-30 15:02:13.140 2021-03-30 15:03:47.613 
20 2021 0 80 Tabulator 20 - Batch 2021 79 2021-03-30 15:02:16.017 2021-03-30 15:03:51.317 
20 2023 0 82 Tabulator 20 - Batch 2023 81 2021-03-30 15:02:22.517 2021-03-30 15:04:13.667 
20 2024 0 83 Tabulator 20 - Batch 2024 82 2021-03-30 15:02:26.050 2021-03-30 15:04:18.870 
20 2025 0 84 Tabulator 20 - Batch 2025 83 2021-03-30 15:02:29.580 2021-03-30 15:04:18.527 
20 2026 0 85 Tabulator 20 - Batch 2026 84 2021-03-30 15:02:33.597 2021-03-30 15:04:20.793 
10 1001 0 87 Tabulator 10 - Batch 1001 86 2021-03-30 15:02:40.610 2021-03-30 15:04:48.777 
10 1002 0 88 Tabulator 10 - Batch 1002 87 2021-03-30 15:02:44.050 2021-03-30 15:04:49.120 
10 1003 0 89 Tabulator 10 - Batch 1003 88 2021-03-30 15:02:47.423 2021-03-30 15-04-48 417 
10 1000 0 96 Tabulator 10 - Batch 1000 114 2021-03-30 16:04:55.357 2021-03-30 16:17:49.813 


March 30, 2021, 3:00 PM - 3:03 PM 


During this three-minute time period, records of 42 batches and the 4,082 ballots 
contained within them, previously processed into the original Adjudication 
database, were copied into the new Adjudication database. According to the time 
stamps, the records of the batches appeared in the new Adjudication database 
in intervals of a fraction of a second between them, much too quickly for the 
ballots contained in the batches to have been physically scanned (per the 
maximum scanning speeds discussed above). Mesa County election clerks state 
that they did not take any action to reprocess or re-scan any batches on that 
day, nor did they at any time stop and restart the Adjudication software process. 
Only 39 ballots in these 42 batches went through manual adjudication after 
being copied to the new database, and database records indicate that the 
adjudication process was completed successfully on those 39 ballots. 
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Unlike what was found in the November 2020 General Election records described 
above, the records for these 42 batches which were copied to the new database 
do not appear in the new Adjudication database in exactly the same order as 
they had originally been loaded; 12 batch records are out of order when the 
records in the original Adjudication database and the new Adjudication database 
are compared. 


No further anomalies are shown in the Adjudication database records during the 
Election counting process, nor did Mesa County election clerks encounter any 
unexpected issues. 


Of the 42 batches which were processed twice (batches 45 through 49 and 51 
through 88), the ballot counts (total number of ballots) match between the old 
and new Adjudication databases. However, DVS software sent 339 ballots to 
manual adjudication the first time they were processed in the original 
Adjudication database, but when reprocessed in the new Adjudication database 
the software sent just 39 ballots to manual adjudication. 


The same ballots run through the same hardware and evaluated by the same 
software should have had the same resulting ballots marked for adjudication, 
but they did not. This leads to the logical critical conclusion that not all the 
ballots in the batches processed after the database copy were the same and had 
the same votes as the ballots in the same batches processed before the database 
copy. There is no record remaining of the votes originally recorded from the 
ballots, and therefore there can be no certainty that the votes now recorded are 
the same. In essence, the chain of custody has been broken for these votes in 
the database. 


The 46 batches which were not duplicated in the new Adjudication database 
must also be seen as suspect, as their chain of custody has also been broken via 
the fact that no record of them or their adjudication exists in the Adjudication 
database in use at the end of the election. A clerk wishing to view the 
adjudication status of a ballot in any of these 46 batches would be unable to do 
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SO, aS no information about these batches exists in the new Adjudication 
database. 


Thus, all 8,540 ballots processed before 2:58 PM on March 30, 2021, comprising 
over 49% of the total votes in the entire 2021 Grand Junction Municipal Election, 
cannot be verified and should not have been counted. These 8,540 ballots 
represent more than twice the winning margin in any of the four City Council 
races that occurred in this election. 


III. Comparison of the November 2020 General Election Findings and the 
April 2021 Grand Junction Municipal Election Findings 


Comparing the above findings for the two elections shows numerous similarities 
and also critical differences. 


Similarities: 

e In both elections, a software process running within the DVS system 
performed an unauthorized creation of new Adjudication and Tabulation 
databases. 

e In both elections, database records of selected batches and of the ballots 
within those batches were copied into the new databases and were 
reprocessed. 

e In both elections, selected batches were not copied to the new Adjudication 
and Tabulation databases, making adjudication information invisible to the 
Mesa County election clerks. 


Differences: 

e In the November 2020 General Election, records of a sequential series of 
batches and the ballots contained within them were copied from the original 
Adjudication and Tabulation databases to the new Adjudication and 
Tabulation databases, and the batches were copied in the same order as in 
the original databases. In the April 2021 Grand Junction Municipal Election, 
records of a non-sequential series of batches and the ballots contained within 
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them were copied, and they appear in the new Adjudication database in a 
different order than in the original database. 

e In the April 2021 Grand Junction Municipal Election, the EMS User Logs 
(which show events and commands which were executed) show reference to 
a batch 89. As there were 88 batches in the original Adjudication database, 
this would have logically been the next batch received from the scanners. 
However, no record of a batch with the load order ‘89’ exists in either 
Adjudication database, and there are missing load orders between 88 and 114 
as well. 


The similarities lead to the conclusion that the same method was used to alter 
the database records in both elections. 


The differences lead to the conclusion that there is a degree of control in the 
method used to alter the database records which used parameters unique to 
each election. 


IV. Summary Impact of Above Findings 


This manipulation of batch and ballot records described above is significant for 
three reasons. 


First, when the ballots were reprocessed as described above, including re- 
adjudication, it is logical to conclude that whatever votes had been initially 
recorded could well have been replaced by the reprocessed votes in the Main 
election database. The differences in the Manual Adjudication numbers certainly 
supports this possible conclusion. Thus, this procedure could change votes in the 
Main database without leaving any evidence to indicate changes had been made, 
or any way to determine the nature of the changes or what the original vote data 
was. 


Second, the adjudication status (including the timestamps of adjudication 
events, the results of the adjudication, and the user who performed the 
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adjudication) of any ballots in the batches not copied to the new Adjudication 
database would not be viewable through the DVS client software applications. 


Third, an examination of the EMS server which was less rigorous than ours would 
not likely have caught the fact that the Adjudication and Tabulation databases 
used at the end of the elections were not the same, nor did they contain the 
same records, as the databases used at the beginning of the elections. This leads 
to the possible conclusion that some batches and ballots were excluded from the 
new databases so as to inhibit the possibility of their being audited or examined. 


V. Lack of Referential Integrity in DVS Database Tables 


Most modern database designs include a concept called “referential integrity.” 
For example, if you have one table of data that has information about “people,” 
and another table that has information about “colleges,” you might have a field 
in an individual record in the “people’s” table that can contain an id, or pointer, 
to the college he or she attended. Referential integrity, in this case, would mean 
that if “John Smith’s” record had a pointer to the “University of Pittsburgh”, the 
system should give an error if you try to remove the item “University of 
Pittsburgh” from the “colleges” table. It would not allow you to do this action 
because a field in “John Smith’s” record refers to the college “University of 
Pittsburgh” and deleting that entry in the “colleges” table makes “John Smith’s” 
record invalid. 


However, some of the DVS Election Management System data structures have no 
such referential integrity built into them. Therefore, batch records in one 
database could be deleted without any consequence to records that point to that 
batch in another database, and without any detection of the error. This lack of 
referential integrity means that vote or ballot information could easily be added 
or removed from one part of the database without any warnings or errors 
occurring in other parts of the database. 


It is, for example, possible to change the fields with vote counts in one table of 
the Main election database without having that change affect any other tables 
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or cause a referential integrity violation. This is a fundamental and critical breach 
of sound database design, particularly considering the importance of chain-of- 
custody and audit trail evidence for the provenance of ballot record and 
tabulated vote information in a voting system. 


Please see Reference D for an example of how the batch and ballot data moves 
through the various databases and tables in the Dominion EMS. 


VI. Digital Ballot Images are Obfuscated and Unverifiable 


An attempt was made to investigate the conditions of the digital ballot images 
to corroborate the findings above. This avenue of research is greatly hindered 
because the ballot IDs or sequence numbers in the batches are not relatable to 
their images, not even within the DVS databases themselves. This is an additional 
example of a lack of referential integrity within the system. 


Additionally, the digital ballot images do not have the accompanying “.sha” files 
which are meant to prove the authenticity of the ballots. Therefore, any findings, 
including the integrity and authenticity of ballot images, related to the digital 
ballot images cannot be absolutely validated because there is no proof that the 
images are the ones created at the time the ballots were first processed. 


Finally, code running within the EMS server that has the system access rights to 
create and alter SQL Server database records could be used to alter the stored 
digital ballot images themselves. The EMS Adjudication module software already 
has the capability of altering scanned images and legitimately does so for each 
manually adjudicated ballot. 


DISCUSSION 
The events described above show a significant manipulation of a large number 


of batch, ballot, and vote records in the DVS EMS Database in Mesa County, and 
there are only a few possible explanations for the manipulation. 
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1. Human Error 


Extensive questioning of Mesa County election clerks has ruled out human 
error as the reason for the unauthorized creation of election databases on 
October 21, 2020, followed by reprocessing of 20,346 ballots. These 
personnel have a strong recollection of the events of October 21, 2020, and 
because of the timelines established both by their recollection and 
corresponding database time stamps, it is evident that any and all unusual 
actions they might have taken on that day were in response to the new 
database’s creation having already occurred, and batch records being 
copied into the new database, which affected their ability to complete 
adjudication on some in-process ballots. Similarly, Mesa County election 
officials have a strong recollection of the events of March 30, 2021. They 
state that they did not take any steps that would have given rise to the 
unauthorized creation of new election databases during the 2021 Grand 
Junction Municipal Election on that day, followed by the reprocessing of 
2,974 ballots,. 


2. Software Failure 


While an error or failure in the DVS EMS server is a possibility, it strains 
credulity that any error could cause the numerous specific events which are 
documented above. In particular, the non-seguential reloading of the 
batches during the 2021 Grand Junction Municipal Election, when 
compared with the sequential reloading in the November 2020 General 
Election, makes it inherently impossible for the same error to have caused 
both chains of events. 


However, as noted in the section above labelled “Algorithmically Triggered”, 
the DVS EMS server (or another connected machine running Dominion 
software) could have been preprogrammed to perform the unauthorized 
new database creations and the selected record manipulation which 
followed based on preprogrammed criteria related to the election results 
at the time. This would be the result of advance planning in the deliberate 
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design of the software to alter outcomes when unexpected voting patterns 
were detected. 


3. Network Breach or Pre-Installation of Manipulating Software or 
Algorithm 


A device external to the DVS D-Suite network could have connected to the 
DVS D-Suite and to the EMS server, using the open SQL Server port 1433, 
open Web Services port 80, or through any other open port directly into the 
DVS Software. As outlined in “Report #2, Forensic Examination and Analysis 
Report” by D. Gould, there are numerous flaws in the security of the server, 
many of which could provide an outside entity with direct access to the SQL 
Server Database or the Application itself. The DVS D-Suite makes use of 
“SOAP” messaging protocol API calls through its web server, so malicious 
procedures could be triggered by simple port 80 access. 


As all Windows log files which would show these accesses are configured, 
as specified by DVS manuals published by the Colorado Secretary of State 
as mandatory technical procedures for County election officials, to keep 
only a small amount of log entries before they are overwritten, no record 
of external access to the DVS D-Suite is available in system logs. 


Regardless of whether the voting system was connected to an external 
network or device, even momentarily, or whether a pre-installed software 
or algorithm was triggered by an external command or complex set of 
variable conditions, the execution of manipulating software or algorithm 
could plausibly be responsible for the results described in our findings. 


CONCLUSIONS 


1. Unauthorized creation of new Tabulation and Adjudication databases 
occurred during the counting of the November 2020 General Election, along 
with the selective copying of batch and ballot records from the original 
databases to the new ones. This manipulation places all 25,913 initial 
ballots counted into a state where they cannot be validated - some because 
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it is possible that their vote information was changed, and unverifiable that 
it was not, and the rest because their “chain of evidence” has been 
intentionally obfuscated. Even if the count and content of ballot images 
match the numbers and counts reported by the database, there is no 
method to validate those ballot images due to missing “.sha” files, which 
are intended to provide such validation. 


2. Unauthorized creation of new Tabulation and Adjudication databases 
occurred during the 2021 Grand Junction Municipal Election, along with 
the selective copying of batch and ballot records from the original 
databases to the new ones. This places all 8,540 initial ballots counted into 
a state where they cannot be validated - some because it is possible that 
their vote information was changed and unverifiable that it was not, and 
some because their “chain of evidence” has been intentionally obfuscated. 


3. AS we have found evidence that thousands of ballot records have had their 
validity placed in serious question, none of the election results from the 
2020 General or 2021 Grand Junction Municipal Elections in Mesa County 
can be considered trustworthy. If Mesa County has preserved the respective 
paper ballots, as they are required to do by law, and those ballots were 
forensically authenticated with confirmed chain-of-custody from eligible 
electors to sworn county election officials (not possible retrospectively, nor 
under current election procedures in Colorado), then a hand-count of paper 
ballots might support a verifiable, trustworthy conclusion about the county- 
level results of these two elections. 


4. Because the unauthorized methods used to alter batch and ballot-level 
information described above are available within the DVS EMS server, this 
system cannot be considered reliable for use in any election. An 
investigation, involving all physical and cyber evidence, including a source 
code audit of the exact, verifiable version of all DVS-supplied executable 
and library files, is necessary to identify the exact software methods used 
to produce the manipulation and to determine other potential unauthorized 
actions that the code is able to cause or enable. 
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5. The Dominion Voting System’s database structure stores actual vote 
information in only one table, in aggregated form, so alterations made to 
vote counts or candidates in just that table, create a single point of attack 
or failure for the entire vote reporting process (see Reference D). 
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REFERENCE A - DATABASES AND TABLES 


In order to assist other researchers, who may wish to examine these findings or 
perform additional analysis, here are the most important databases and tables 
which were used in this analysis. 


Main election databases: 


November 2020 General Election: 
[2020 Mesa County General-2020-09-05-00-10-20] 


April 2021 Municipal Election: 
[City of Grand Junction-Municipal Election 2021-2021-02-05-16-01-32] 


Primary Tables (specifically related to vote totals): 
ResultContainer. (Batch level raw vote data) 
ResultSplitter. (Vote Data by Polling Location 
ChoiceResult. (Raw aggregated vote data) 
CastVoteRecord: (Raw per-ballot list) 

Choice: (All Candidates/Choices) 

Contest: (All contests in Election) 

Tabulator. (All defined tabulators) 


Stored Procedures (useful for checking final results): 

GetContestResults: Displays Current results of any or all contests 
GetContestStatistics: Displays stats for any or all contests, including undervotes and 
overvotes 


Adjudication databases: 


November 2020 General Election: 
[AdjudicableBallotStore_2020_Mesa_County_General_2020-10-01_12:18:50] (before 


copy) 
[AdjudicableBallotStore 2020 Mesa County General 2020-10-21 14:18:51] (after 


copy) 


April 2021 Municipal Election: 
[AdjudicableBallotStore_City_Of_Grand_Junction_Municipal_Election_2021_2021-03- 
18_10:48:14] (before copy) 
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[AdjudicableBallotStore_City_Of_Grand_Junction_Municipal_Election_2021_2021-03- 
30_14:58:56] (after copy) 


Primary Tables: 

Batches: Raw batch information 

SerializedAdjudicableBallots: Contains one data record for each ballot received. 
BallotStatusEvents: Every ballot with Adjudication status. New records for same ballot 
whenever any change occurs in the status of the ballot. 
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REFERENCE B - SCANNER SPEED 


4.5 Processing Rate 


The central scanning device’s processing rate also depends on the handling and 
poll verification activities. 


The number of ballots per minute depends on the width or length of the ballot. 
The following table documents the approximate scanning speed of the ICC 
scanners. 


Scanner | Ballot Size | Pages per Minute (ppm) Scanned 


Canon DR-G1130 | 8.57 x 11” Approximately 100 ppm, as per Dominion 
Voting’s Quality Assurance test results. 


Canon DR-G2140 | 8.5” x 22” Aproximately 70 ppm, as per Dominion 
Voting’s Quality Assurance test results. 


Canon DR-M160II | 8.5” x 11” Approximately 60 ppm, as per Dominion 
Voting’s Quality Assurance test results. 


https://www.sos.state.co.us/pubs/elections/VotingSystems/DVS-DemocracySuite511/documentation/2-03-ICC-FunctionalityDescription-5- 
11-CO.pdf 
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REFERENCE С - SCANNERS USED BY MESA COUNTY 


DESCRIPTION QTY UNIT PRICE EXTENSION 
Central Scanning Hardware & Software License 


ImageCast Central Includes: 4 $18,500 $74,000 
Canon DR-G1130 high speed document scanner. 

- ІтадеСаѕі Central Software including third party Kofax VRS 4.5 software. 

- OptiPlex 9020 All-in-One Series with pre-loaded software 

- Опе (1) iButton Programmer апа (1) iButton Key Switch & Cat5 RJ 45 
Cables 

- 12 months Hardware Warranty 

- 12 months Firmware License 


https://onbase.mesacounty.us/OnBaseAgendaOnline/Documents/Downloadfile/Special_ Meeting 1018 Agenda Packet 8 24 2021 1 00 0 
О _PM.pdf?documentType=5 &meetingId=1018 &isAttachment=True 
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REFERENCE D - DATA MOVEMENT FROM BATCHES TO VOTES 


Below please find an example of how the data moves through the system from 
the batch to its votes, and how the ballot level vote data is obfuscated in the 
process. Blank and irrelevant fields are omitted. 


When batch 4025 was received in the Mesa County November 2020 election, the 
following record was created in the batches table of the Adjudication database. 


Field Value 
TabulatorId 10 
BatchId 4025 
Name Tabulator 10 - Batch 4025 
LoadOrder 60 
CreationTime 10/21/20 2:20 PM 
ModificationTime 10/22/20 10:33 AM 
BallotCount 99 
HasAdjudicatedBallots 1 


After all adjudication tasks were complete, a record exists in the Main election 
database ResultContainer table. 


Field Value 
Id 60 
containerType CVR 
resultState Published 
batchId 4025 
fileName 1 1 10 4025 DETAIL.DVD 
tabulatorId 10 
CvrSortOrder 60 
TimeStamp 10/19/20 4:12 PM 


This table serves as a record of each individual batch received, and the batchId 
field (4025 in this case) references the BatchId of the Adjudication database’s 
Batches table, as shown above. This is the first evidence of a break in referential 
integrity, as there is no database-level relationship between these two tables. In 
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altered without any warning or error being generated by the database. 


Of note also is that the number of ballots which exists in each batch is not a part 


of the ResultConta/ner table. This makes reconciling the data in the Main election 
database tables much more difficult. 


From here, the information goes to three other tables of interest in the Main 


election database. The first is CastVoteRecord, which contains the ballot-level 


vote data. 
Id ResultContainerId | RecordId | PrecinctPortionId | IsCurrent | OriginalCvrId | OutstackConditions | BallotTypeId | tabulatorId | batchId 
5892 60 1 124 1 | NULL 1088 5 10 4025 
5893 60 2 103 1 | NULL 1088 7 10 4025 
5894 60 3 66 O | NULL 256 8 10 4025 
5895 60 4 44 1 | NULL 1088 3 10 4025 
5896 60 5 111 1 | NULL 1088 7 10 4025 
5897 60 6 63 1 | NULL 1088 7 10 4025 
5898 60 7 79 1 | NULL 0 7 10 4025 
5899 60 8 98 1 | NULL 0 7 10 4025 
5900 60 9 22 1 | NULL 1088 3 10 4025 
5901 60 10 22 O | NULL 256 3 10 4025 
5902 60 11 111 1 | NULL 0 7 10 4025 
5903 60 12 134 1 | NULL 0 7 10 4025 
5904 60 13 134 O | NULL 256 7 10 4025 
5905 60 14 4 1 | NULL 1088 1 10 4025 
5906 60 15 100 1 | NULL 1088 7 10 4025 
5907 60 16 98 1 | NULL 1088 7 10 4025 
5908 60 17 40 1 | NULL 0 1 10 4025 
5909 60 18 129 1 | NULL 1088 7 10 4025 
5910 60 19 124 1 | NULL 1088 5 10 4025 
5911 60 20 108 1 | NULL 0 7 10 4025 
5912 60 21 131 O | NULL 5 7 10 4025 
5913 60 22 41 O | NULL 1344 1 10 4025 
5914 60 23 42 O | NULL 256 1 10 4025 
5915 60 24 13 1 | NULL 1088 2 10 4025 
5916 60 25 42 1 | NULL 1088 1 10 4025 
5917 60 26 2 1 | NULL 0 1 10 4025 
5918 60 27 42 1 | NULL 0 1 10 4025 
5919 60 28 60 1 | NULL 0 7 10 4025 
5920 60 29 95 1 | NULL 0 7 10 4025 
5921 60 30 100 1 | NULL 1088 7 10 4025 
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5922 60 31 10 1 | NULL 1088 1 10 4025 
5923 60 32 117 1 | NULL 1088 5 10 4025 
5924 60 33 101 1 | NULL 0 7 10 4025 
5925 60 34 10 O | NULL 256 1 10 4025 
5926 60 35 102 1 | NULL 1088 7 10 4025 
5927 60 36 60 1 | NULL 0 7 10 4025 
5928 60 37 101 1 | NULL 1088 7 10 4025 
5929 60 38 T 1 | NULL 1088 1 10 4025 
5930 60 39 41 1 | NULL 0 1 10 4025 
5931 60 40 101 O | NULL 1344 7 10 4025 
5932 60 41 62 1 | NULL 1088 8 10 4025 
5933 60 42 46 1 | NULL 1088 1 10 4025 
5934 60 43 70 1 | NULL 0 8 10 4025 
5935 60 44 63 1 | NULL 1088 7 10 4025 
5936 60 45 100 1 | NULL 0 7 10 4025 
5937 60 46 94 1 | NULL 1088 7 10 4025 
5938 60 47 101 1 | NULL 1088 7 10 4025 
5939 60 48 79 1 | NULL 1088 7 10 4025 
5940 60 49 131 O | NULL 1 7 10 4025 
5941 60 50 3 1 | NULL 0 1 10 4025 
5942 60 51 108 1 | NULL 0 7 10 4025 
5943 60 52 63 1 | NULL 0 7 10 4025 
5944 60 53 105 1 | NULL 0 7 10 4025 
5945 60 54 100 1 | NULL 0 7 10 4025 
5946 60 55 17 1 | NULL 0 3 10 4025 
5947 60 56 40 1 | NULL 0 1 10 4025 
5948 60 57 101 1 | NULL 0 7 10 4025 
5949 60 58 60 1 | NULL 1088 7 10 4025 
5950 60 59 22 O | NULL 1 3 10 4025 
5951 60 60 134 1 | NULL 1088 7 10 4025 
5952 60 61 103 1 | NULL 1088 7 10 4025 
5953 60 62 60 1 | NULL 0 7 10 4025 
5954 60 63 7 1 | NULL 1088 1 10 4025 
5955 60 64 52 1 | NULL 0 3 10 4025 
5956 60 65 100 1 | NULL 1088 7 10 4025 
5957 60 66 100 O | NULL 256 7 10 4025 
5958 60 67 101 1 | NULL 0 7 10 4025 
5959 60 68 79 1 | NULL 0 7 10 4025 
5960 60 69 100 1 | NULL 0 7 10 4025 
5961 60 70 129 1 | NULL 1088 7 10 4025 
5962 60 71 98 1 | NULL 0 7 10 4025 
5963 60 72 138 1 | NULL 0 7 10 4025 
5964 60 73 119 1 | NULL 0 7 10 4025 
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5965 60 74 50 1 | NULL 1088 1 10 4025 
5966 60 75 102 1 | NULL 0 7 10 4025 
5967 60 76 100 1 | NULL 0 7 10 4025 
5968 60 77 22 1 | NULL 1088 3 10 4025 
5969 60 78 60 1 | NULL 1088 7 10 4025 
5970 60 79 44 O | NULL 1344 3 10 4025 
5971 60 80 101 1 | NULL 0 7 10 4025 
5972 60 81 111 1 | NULL 1088 7 10 4025 
5973 60 82 129 1 | NULL 0 7 10 4025 
5974 60 83 98 1 | NULL 1088 7 10 4025 
5975 60 84 111 1 | NULL 1088 7 10 4025 
5976 60 85 34 1 | NULL 0 1 10 4025 
5977 60 86 35 1 | NULL 1088 1 10 4025 
5978 60 87 17 1 | NULL 0 3 10 4025 
5979 60 88 50 1 | NULL 1088 1 10 4025 
5980 60 89 104 1 | NULL 0 7 10 4025 
5981 60 90 104 1 | NULL 0 7 10 4025 
5982 60 91 30 1 | NULL 0 1 10 4025 
5983 60 92 134 1 | NULL 0 7 10 4025 
5984 60 93 134 1 | NULL 1088 7 10 4025 
5985 60 94 101 1 | NULL 1088 7 10 4025 
5986 60 95 105 1 | NULL 1088 7 10 4025 
5987 60 96 52 1 | NULL 1088 3 10 4025 
5988 60 97 105 O | NULL 256 7 10 4025 
5989 60 98 100 1 | NULL 1088 7 10 4025 
5990 60 99 98 O | NULL 1344 7 10 4025 
9514 60 3 66 1 5894 0 8 10 4025 
9515 60 10 22 1 5901 0 3 10 4025 
9516 60 13 134 1 5904 0 7 10 4025 
9517 60 22 41 1 5913 1088 1 10 4025 
9518 60 23 42 1 5914 0 1 10 4025 
9519 60 21 131 1 5912 1092 7 10 4025 
9620 60 34 10 1 5925 0 1 10 4025 
9621 60 49 131 1 5940 1088 7 10 4025 
9622 60 40 101 1 5931 1088 7 10 4025 
9623 60 59 22 1 5950 1 3 10 4025 
9624 60 66 100 1 5957 256 7 10 4025 
9625 60 79 44 1 5970 1088 3 10 4025 
9626 60 99 98 1 5990 1088 7 10 4025 
9728 60 97 105 1 5988 0 7 10 4025 


Page 80 of 87 


CASE 0:22-cv-02290-ECT-ECW Doc. 10-6 Filed 09/21/22 Page 40 of 46 


There is one record for each ballot in batch 4025, and then an additional record 
for each ballot which went through the manual adjudication process. The 
IsCurrent field indicates which of the two ballot records is the latest one. No 
timestamp exists in this table to be able to determine the time the ballot data 
was entered or modified. 


Unlike a “Cast Vote Record” file, this table contains no vote information. 


Next is ResultSplitter. Batch 4025 was separated into 42 rows in this table: 


Id numberOfValid pollingDistrictId resultContainerId numberOfwWriteIns tabulatorId ballotId 
2008 1 30 60 0 10 1 
2007 2 104 60 0 10 7 
2006 1 35 60 0 10 1 
2005 1 34 60 0 10 1 
2004 2 50 60 0 10 1 
2003 1 119 60 0 10 7 
2002 1 138 60 0 10 7 
2001 2 52 60 0 10 3 
2000 2 17 60 0 10 3 
1999 3 105 60 0 10 7 
1998 1 3 60 0 10 1 
1997 1 94 60 0 10 7 
1996 1 70 60 0 10 8 
1995 1 46 60 0 10 1 
1994 1 62 60 0 10 8 
1993 2 7 60 0 10 1 
1992 2 102 60 0 10 7 
1991 8 101 60 0 10 7 
1990 1 117 60 0 10 5 
1989 2 10 60 0 10 1 
1988 1 95 60 0 10 7 
1987 5 60 60 0 10 7 
1986 1 2 60 0 10 1 
1985 1 13 60 0 10 2 
1984 3 42 60 0 10 1 
1983 2 41 60 0 10 1 
1982 2 131 60 0 10 7 
1981 2 108 60 0 10 7 
1980 3 129 60 0 10 7 
1979 2 40 60 0 10 1 
1978 9 100 60 0 10 7 
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1977 1 4 60 0 10 1 
1976 5 134 60 0 10 7 
1975 4 22 60 1 10 3 
1974 5 98 60 0 10 7 
1973 3 79 60 0 10 7 
1972 3 63 60 0 10 7 
1971 4 111 60 0 10 7 
1970 2 44 60 0 10 3 
1969 1 66 60 0 10 8 
1968 2 103 60 0 10 7 
1967 2 124 60 0 10 5 


The 99 ballots in batch 4025 are segregated here by polling district number. No 
vote information appears in this table, and this table links back to its 
corresponding record in the ResultContainertable through the resultContainerId 
field. Again, this table contains no specific vote information for the ballots. 


Next is the table ChoiceResult. Because of how the records are aggregated, there 
are over 1,600 records for batch 4025. For brevity, only the first 49 records are 
displayed. 


Id numberOfVotes isValid contestResultId pollingDistrictId tabulatorId | resultContainerId | choiceld partyId 
72135 2 1 56749 63 10 60 82 0 
72136 1 1 56749 63 10 60 83 0 
72137 2 1 56750 63 10 60 88 0 
72138 1 1 56750 63 10 60 89 0 
72139 2 1 56751 79 10 60 2 0 
72140 1 1 56751 79 10 60 1 0 
72141 2 1 56752 79 10 60 23 5 
72142 1 1 56752 79 10 60 22 2 
72143 2 1 56753 79 10 60 27 5 
72144 1 1 56753 79 10 60 28 2 
72145 2 1 56754 79 10 60 32 5 
72146 1 1 56754 79 10 60 31 2 
72147 2 1 56755 79 10 60 35 5 
72148 1 1 56755 79 10 60 36 2 
72149 2 1 56756 79 10 60 38 5 
72150 2 1 56757 79 10 60 39 5 
72151 1 1 56757 79 10 60 40 2 
72152 2 1 56758 79 10 60 42 5 
72153 1 1 56758 79 10 60 41 2 
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72154 3 1 56759 79 10 60 44 0 
72155 3 1 56760 79 10 60 46 0 
72156 3 1 56761 79 10 60 48 0 
72157 3 1 56762 79 10 60 50 0 
72158 2 1 56763 79 10 60 74 0 
72159 1 1 56763 79 10 60 75 0 
72160 3 1 56764 79 10 60 76 0 
72161 3 1 56765 79 10 60 78 0 
72162 3 1 56766 79 10 60 80 0 
72163 2 1 56767 79 10 60 53 0 
72164 1 1 56767 79 10 60 52 0 
72165 3 1 56768 79 10 60 55 0 
72166 2 1 56769 79 10 60 56 0 
72167 1 1 56769 79 10 60 57 0 
72134 3 1 56748 63 10 60 7З 0 
72133 1 1 56747 63 10 60 71 0 
72132 2 1 56747 63 10 60 70 0 
72131 3 1 56746 63 10 60 68 0 
72130 2 1 56745 63 10 60 66 0 
72129 1 1 56745 63 10 60 67 0 
72128 2 1 56744 63 10 60 65 0 
72127 1 1 56744 63 10 60 64 0 
72126 1 1 56743 63 10 60 63 0 
72125 2 1 56743 63 10 60 62 0 
72124 1 1 56742 63 10 60 60 0 
72123 2 1 56742 63 10 60 61 0 
72122 2 1 56741 63 10 60 59 0 
72121 1 1 56741 63 10 60 58 0 
72120 1 1 56740 63 10 60 57 0 
72119 2 1 56740 63 10 60 56 0 


This table, the only table which actually has a record of the vote totals used to 
produce reports, aggregates the votes by polling district and candidate or issue 
choice. As an example, the fifth line of data specifies that there are two votes for 
Donald Trump (cfioiceid 2, which references the /nternalMachineld field of the 
table Choice) from polling district 3075539035 - GJ (pollingDistrictId 79, which 
references the /nternalMachineld field of the table PollingDistrict). 


From this table, and the associated tables it links to, all reports are generated. 
As this is the only table which records vote choices, this is a single point of attack 
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or failure for the entire vote counting process of the Dominion system. Changes 
can be made to this table by any process, for instance changing the number of 
votes or the candidate, would be undetectable as such changes do not affect any 
other records in any other tables. Nor would such changes require alterations of 
any other records in any other tables. 


Additionally, there is no way to consistently link a particular vote shown in the 
ChoiceResult table to its original ballot within the batch. 
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The foregoing Forensic Examination and Report was prepared by us, and we 
are responsible for its content. 


The 19" дау of March 2022. 
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